diff --git a/.gitea/workflows/cicd.yaml b/.gitea/workflows/cicd.yaml
index 040d379..4c74f34 100644
--- a/.gitea/workflows/cicd.yaml
+++ b/.gitea/workflows/cicd.yaml
@@ -1244,6 +1244,30 @@ jobs:
           umask 077
           trap 'rm -f ~/.ssh/id_rsa' EXIT
 
+          retry_cmd() {
+            attempts="${1:-5}"
+            backoff="${2:-2}"
+            shift 2
+
+            attempt=1
+            while [ "${attempt}" -le "${attempts}" ]; do
+              if "$@"; then
+                return 0
+              fi
+
+              if [ "${attempt}" -lt "${attempts}" ]; then
+                sleep_seconds=$((backoff * attempt))
+                echo "Command failed (attempt ${attempt}/${attempts}): $*"
+                echo "Retrying in ${sleep_seconds}s"
+                sleep "${sleep_seconds}"
+              fi
+              attempt=$((attempt + 1))
+            done
+
+            echo "Command failed after ${attempts} attempts: $*"
+            return 1
+          }
+
           if ! grep -q "${GITEA_REGISTRY_HOST}" /etc/hosts; then
             echo "${GITEA_REGISTRY_IP} ${GITEA_REGISTRY_HOST}" >> /etc/hosts
           fi
@@ -1251,12 +1275,13 @@ jobs:
           mkdir -p ~/.ssh
           echo "${SSH_PRIVATE_KEY}" > ~/.ssh/id_rsa
           chmod 600 ~/.ssh/id_rsa
-          ssh-keyscan -p "${GITEA_SSH_PORT}" "${GITEA_SSH_HOST}" >> ~/.ssh/known_hosts 2>/dev/null
 
-          GIT_SSH_COMMAND="ssh -i ~/.ssh/id_rsa -o IdentitiesOnly=yes -o StrictHostKeyChecking=no" \
+          retry_cmd 5 2 sh -c "ssh-keyscan -p '${GITEA_SSH_PORT}' '${GITEA_SSH_HOST}' >> ~/.ssh/known_hosts 2>/dev/null"
+
+          retry_cmd 5 3 env GIT_SSH_COMMAND="ssh -i ~/.ssh/id_rsa -o IdentitiesOnly=yes -o StrictHostKeyChecking=no" \
             git clone --depth 1 --no-checkout "${GITEA_REPO_SSH_URL}" .
 
-          if GIT_SSH_COMMAND="ssh -i ~/.ssh/id_rsa -o IdentitiesOnly=yes -o StrictHostKeyChecking=no" \
+          if retry_cmd 5 3 env GIT_SSH_COMMAND="ssh -i ~/.ssh/id_rsa -o IdentitiesOnly=yes -o StrictHostKeyChecking=no" \
             git fetch --depth 1 origin "${HEAD_SHA}" >/dev/null 2>&1; then
             git checkout FETCH_HEAD -- \
               .dockerignore \